Documentation for different paths

This might sound obvious, but there is no real section where each kind of path is at least defined. What is a ${type} path ? In which case is it useful ? It can be interesting to clearly have an explanation on that, to avoid looking for example only at found path when your answer is in a deadended one.

I would have taken care of it myself if I wasn’t one of the people that don’t know what these types are 😃

[zardus]

Thank you for these docs, @P1kachu!

I moved the path types discussion into pathgroups.md (as, other than errored, the only thing that influences the “type” of the path is what stash it’s in in the pathgroup) and expanded on it. The result is here: https://github.com/angr/angr-doc/blob/master/docs/pathgroups.md#stash-types. What do you think? Is this what you were looking for for the rest of them?

[ltfish]

A path goes to deadended when we cannot continue the execution for some reason, including no more valid instructions, the state becomes unsat, or invalid instruction pointer.

A path goes to found when the execution reaches a basic block which begins at the address that you specified with the find argument in PathGroup.explorer().

looking for example only at found path when your answer is in a deadended one

That means the path you are looking for never had a basic block that starts at the address that you specified. Note that PathGroup.explorer() only checks if the beginning of the basic block is one of the given addresses. If the address appears in the middle of a basic block, it won’t be counted as found right now.

Saying that, we will change this behavior some time in the near future, so that you can put any address in the middle of the target basic block as the address to find. I believe this is way friendlier!